Description
Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider "don't send" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.
Remediation
References
Related Vulnerabilities
WordPress Plugin Image Gallery-Responsive Photo Gallery Cross-Site Scripting (1.7.0)
IBM RTC Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2012-0748)
WordPress Plugin Agent Storm by StormRETS Multiple Cross-Site Scripting Vulnerabilities (1.1.35)
WordPress Plugin Pressbooks Cross-Site Scripting (2.4.2)
WordPress Plugin W3 Total Cache Information Disclosure (0.9.2.4)